Vulnerability · Published May 27, 2025 · Assigned by CERTVDE
CVE-2025-41652Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet Switches
Critical 9.8
In plain English
A critical-severity security flaw in IE-SW-PL10M-3GT-7TX from Weidmueller. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 57.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakness by performing brute-force attacks to guess valid credentials or by using MD5 collision techniques to forge authentication hashes, potentially compromising the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Weidmueller | IE-SW-VL05M-5TX | 0.0.0 – before 3.6.32 |
| Weidmueller | IE-SW-VL05MT-5TX | 0.0.0 – before 3.6.32 |
| Weidmueller | IE-SW-VL08MT-8TX | 0.0.0 – before 3.6.32 |
| Weidmueller | IE-SW-VL08MT-5TX-1SC-2SCS | 0.0.0 – before 3.5.36 |
| Weidmueller | IE-SW-VL08MT-6TX-2SC | 0.0.0 – before 3.5.36 |
| Weidmueller | IE-SW-VL08MT-6TX-2ST | 0.0.0 – before 3.5.36 |
| Weidmueller | IE-SW-VL08MT-6TX-2SCS | 0.0.0 – before 3.5.36 |
| Weidmueller | IE-SW-PL10M-3GT-7TX | 0.0.0 – before 3.3.34 |
| Weidmueller | IE-SW-PL10MT-3GT-7TX | 0.0.0 – before 3.3.34 |
| Weidmueller | IE-SW-PL16M-16TX | 0.0.0 – before 3.4.32 |
| Weidmueller | IE-SW-PL16MT-16TX | 0.0.0 – before 3.4.32 |
| Weidmueller | IE-SW-PL18M-2GC-16TX | 0.0.0 – before 3.4.40 |
| Weidmueller | IE-SW-PL18MT-2GC-16TX | 0.0.0 – before 3.4.40 |
Weakness: CWE-328 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H